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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to communication(s) filed on 01 December 2003 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

_3)D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 
closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-38 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 1-38 is/are rejected. 
'7)0 Claim(s) is/are objected to. 

8) 0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2.0 Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Claims 1-38 remain pending. 

Response to Arguments 

The Applicants arguments filed on December 01, 2003 have been fully considered. 

The Applicant states that claims previously rejected under 35 USC 101 are within the 
technological arts, 

The Examiner responds that as an initial matter, the United States Constitution under Art. 
I, §8, cl. 8 gave Congress the power to M [p]romote the progress of science and useful arts, by 
securing for limited times to authors and inventors the exclusive right to their respective writings 
and discoveries". In carrying out this power, Congress authorized under 35 U.S.C. §101 a grant 
of a patent to "[wjhoever invents or discovers any new and useful process, machine, 
manufacture, or composition or matter, or any new and useful improvement thereof." Therefore, 
a fundamental premise is that a patent is a statutorily created vehicle for Congress to confer an 
exclusive right to the inventors for "inventions" that promote the progress of "science and the 
useful arts". The phrase "technological arts" has been created and used by the courts to offer 
another view of the term "useful arts". See In re Musgrave, 167 USPQ (BNA) 280 (CCPA 
1970). Hence, the first test of whether an invention is eligible for a patent is to determine if the 
invention is within the "technological arts". 

Further, despite the express language of §101, several judicially created exceptions have 
been established to exclude certain subject matter as being patentable subject matter covered by 
§101. These exceptions include "laws of nature", "natural phenomena", and "abstract ideas". 
SesDiamondv. Diehr, 450, U.S. 175, 185, 209 USPQ (BNA) 1,7(1981). However, courts have 
found that even if an invention incorporates abstract ideas, such as mathematical algorithms, the 
invention may nevertheless be statutory subject matter if the invention as a whole produces a 
"useful, concrete and tangible result." See State Street Bank & Trust Co. v. Signature Financial 
Group, Inc. 149 F.3d 1368, 1973, 47 USPQ2d (BNA) 1596 (Fed. Cir. 1998). 

This "two prong" test was evident when the Court of Customs and Patent Appeals 
(CCPA) decided an appeal from the Board of Patent Appeals and Interferences (BPAI). See In 
re Toma, 197 USPQ (BNA) 852 (CCPA 1978). In Toma, the court held that the recited 
mathematical algorithm did not render the claim as a whole non-statutory using the Freeman- 
Walter- Abele test as applied to Gottschalk v. Benson, 409 U.S. 63, 175 USPQ (BNA) 673 
(1972). Additionally, the court decided separately on the issue of the "technological arts". The 
court developed a "technological arts" analysis: 

The "technological" or "useful" arts inquiry must focus on whether the 
claimed subject matter... is statutory, not on whether the product of the claimed 
subject matter.. .is statutory, not on whether the prior art which the claimed subject 
matter purports to replace.. .is statutory, and not on whether the claimed subject 
matter is presently perceived to be an improvement over the prior art, e.g., 
whether it "enhances" the operation of a machine. In re Toma at 857. 
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In Toma, the claimed invention was a computer program for translating a source human language 
(e.g., Russian) into a target human language (e.g., English). The court found that the claimed 
computer implemented process was within the "technological art" because the claimed invention 
was an operation being performed by a computer within a computer. 

The decision in State Street Bank & Trust Co, v. Signature Financial Group, Inc. never 
addressed this prong of the test. In State Street Bank & Trust Co,, the court found that the 
"mathematical exception" using the Freeman- Walter- Abele test has little, if any, application to 
determining the presence of statutory subject matter but rather, statutory subject matter should be 
based on whether the operation produces a "useful, concrete and tangible result". See State Street 
Bank & Trust Co. at 1374. Furthermore, the court found that there was no "business method 
exception" since the court decisions that purported to create such exceptions were based on 
novelty or lack of enablement issues and not on statutory grounds. Therefore, the court held that 
"[w]hether the patent's claims are too broad to be patentable is not to be judged under §101, but 
rather under §§102, 103 and 112." See State Street Bank & Trust Co. at 1377. Both of these 
analysis goes towards whether the claimed invention is non-statutory because of the presence of 
an abstract idea. Indeed, State Street abolished the Freeman- Walter- Abele test used in Toma. 
However, State Street never addressed the second part of the analysis, i.e., the "technological 
arts" test established in Toma because the invention in State Street (i.e., a computerized system 
for determining the year-end income, expense, and capital gain or loss for the portfolio) was 
already determined to be within the technological arts under the Toma test. This dichotomy has 
been recently acknowledged by the Board of Patent Appeals and Interferences (BPAI) in 
affirming a §101 rejection finding the claimed invention to be non-statutory. See Ex parte 
Bowman, 61 USPQ2d (BNA) 1669 (BdPatApp&Int 2001). 

In the present application claims land 21 only recite an abstract idea. The recited steps 
of merely informing an individual about the disclosure of personal information, and verifying 
that this disclosure complies with local laws does not apply, involve, use, or advance the 
technological arts. 

The Applicant states that the Coueignoux (US Patent 6,092,197) reference does not teach 
" privacy practices or privacy law and regulation .... Informing an individual that an entity has 
certified it's compliance with approved privacy and data security practices" 

The Examiner responds that Coueignoux relies on a rules engine to control the 
interaction between the user and an agent, the rule engine allows the user to specify how 
confidential data is to be handled (Colunm 2, lines 62-67)(i.e. the user is informed about the data 
security practices). 

The Applicant states that Clayton reference is not properly citable. 

The Examiner responds that cited references are within the given background of the 
present application and deal with well known and published prior art and are therefore useable. 

See following rejection. 



Claim Rejections - 35 USC §101 
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Claims 1-38 are rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non-statutory subject matter. 

The basis of this rejection is set forth in a two-prong test of: 

(1) whether the invention is within the technological arts; and 

(2) whether the invention produces a useful, concrete, and tangible result. 

. For a claimed invention to be statutory, the claimed invention must be within the 
technological arts. Mere ideas in the abstract (i.e., abstract idea, law of nature, natural 
phenomena) that do not apply, involve, use, or advance the technological arts fail to promote the 
"progress of science and the useful arts" (i.e., the physical sciences as opposed to social sciences, 
for example) and therefore are found to be non- statutory subject matter. For a process claim to 
pass muster, the recited process must somehow apply, involve, use, or advance the technological 
arts. 

In the present case, claims land 21 only recite an abstract idea. The recited steps of 
merely informing an individual about the disclosure of personal information, and verifying that 
this disclosure complies with local laws does not apply, involve, use, or advance the 
technological arts since all of the recited steps can be performed in the mind of the user or by use 
of a pencil and paper. These steps only constitute an idea of how to inform an individual about 
the status of their privacy rights. 

Additionally, for a claimed invention to be statutory, the claimed invention must produce 
a useful, concrete, and tangible result. In the present case, the claimed invention produces 
consent from an individual (i.e., repeatable) in regards to the release of their private data (i.e., 
useful and tangible). 

Although the recited process produces a useful, concrete, and tangible result, since the 
claimed invention, as a whole, is not within the technological arts as explained above, claim 1 is 
deemed to be directed to non-statutory subject matter. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

- Claims 1-5,7-9,16,17,19-27,34,35 and 37-38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Coueignoux (US Patent 6,092,197). 

As per claim 1, 

Coueignoux (' 197) discloses a method for promoting compliance with data protection 
and privacy laws and regulations relating to the privacy rights of individual; that comprises: 
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informing an individual involved in potential disclosure of his/her personal data to an 
entity that the entity has certified its compliance with :approved privacy and data security 
practices that conform to relevant data protection and privacy laws and regulations covering the 
use of personal data in at least the individual's or entity's country of location;(Column 2, lines 39- 
67) 

obtaining the individual's consent to have the entity receive, or acknowledgment that the 
entity will receive, and use his/her personal data in accordance with a stated policy or with 
relevant data protection and privacy laws and regulations covering a use of personal data m at 
least the individual's or the entity's country of location; (Column 3, lines 15-28) 

transmitting to the entity data indicating that t 7c individual has been informed of the 
entity's privacy practices and consented to the entity receiving, or acknowledged that the entity 
will be receiving, and using his/her personal data in accordance with its stated policy or with 
relevant data protection and privacy laws and regulations covering the use of personal data in at 
least the individual's or the entity's country a location;(Column 2, lines 39-61) 

receiving from the entity data comprising per, personal data collected by the entity from 
the individual; storing said personal data received from the entity; (Figure 1) 

Official Notice is taken that "periodically checking whether the entity has complied with 
the stated policy or with relevant data protection and privacy laws and regulation covering the 
use of personal data in at least the individual's or the entity's country of location." is common and 
well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to periodically check whether the entity has complied with the stated policy or with 
relevant data protection and privacy laws and regulation covering the use of personal data in at 
least the individual's or the entity's country of location in order to in order to allow the entity to 
correct any inadvertent violations of privacy laws that might have occurred 

As per claim 2, 

Coueignoux (' 197) discloses a method according to claim 1 . 

Official Notice is taken that " informing the individual that the entity is covered by 
insurance or equivalent risk: instrument to protect against risk of loss of harm caused to the 
individual arising from misuse or loss of the individual's personal data by the entity." is common 
and well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to inform the individual that the entity is covered by insurance or equivalent risk: 
instrument to protect against risk of loss of harm caused to the individual arising from misuse or 
loss of the individual's personal data by the entity in order to in order to promote consumer 
confidence in the system. 

As per claim 3, 

Coueignoux ( c 197) discloses a method according to claim 1 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgment that the entity will receive, and use the individual's personal data comprises 
data uniquely identifying details relating to the individual's consent.(Column 5, lines 44-64) 
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- As per claim 4, 

Coueignoux (' 197) discloses a method according to claim 3 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgement that the entity will receive, and use the individual's personal data and 
uniquely identifying details relating to the individual's consent is compressed using a hash 
function.(Column 13, lines 43-51) 

As per claim 5, 

- Coueignoux (' 1 97) discloses a method according to claim 4 

wherein said data received from the entity comprising personal data collected by the 
entity from :lie individual, includes the data transmitted to the entity uniquely identifying details 
relating to the individual's consent.(Column 6, lines 59-62) 

As per claim 7, 

Coueignoux ('197) discloses a method according to claim 1 

Official Notice is taken that " performed with a multiplicity of entities and individuals 
located in a multiplicity of countries" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to perform with a multiplicity of 
entities and individuals located in a multiplicity of countries in order to maximize efficiency by 
processing multiple entities at a single time. 

As per claim 8, 

Coueignoux ('197) discloses a method according to claim 1 

Official Notice is taken that " the individual is informed in an official language of the 
individual's country of location" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to inform the individual in an official 
language of the individual's country of location in order to allow the individual to comprehend 
the message, and provide a useful service. 

As per claim 9, 

Coueignoux ('197) discloses a method according to claim 1 
conducted as a multi-entity privacy policy certification program requiring member 
entities to certify compliance with approved privacy standards for the use of personal data of 
individuals and providing such entities with a policy notice to confirm their approval by, and 
membership in, the program.(Column 2, lines 39-61) 

As per claim 16, 

Coueignoux ('197) discloses a method according to claim 1 

Wherein the data received from the entity comprising the individual's stored personal 
data includes the time period of the individual's consent or acknowledgment, the length of time 
that the individual's personal data will be retained, and an option to extend or renew the 
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individual's consent or acknowledgment, if desired, notice thereof being provided to the entity an 
a the individual in advance of expiration of the consent. (Column 5, lines 44-64) 

As per claim 17, 

Coueignoux ('197) discloses a method according to claim 16 

wherein the individual is provided with the option of having the individual's personal data 
deleted from the entity's data storage upon expiration of the agreement.(Column 16, lines 43-56) 

As per claim 19, 

Coueignoux (497) discloses a method according to claim 1, 

wherein the steps of informing the individual, obtaining the individual's consent or 

acknowledgment, transmitting, data to the entity, and receiving data from the entity are 

performed over a computer network. (Figure 1) 

As per claim 19, 

Coueignoux ('197) discloses a method according to claim 19, 
wherein the computer network is the Internet.(Figure 1) 

As per claim 21, 

Coueignoux (' 197) discloses a system for promoting compliance with data protection and 
privacy laws and regulations relating to the privacy rights of individual; that comprises: 

means for informing an individual involved in potential disclosure of his/her personal 
data to an entity that the entity has certified its compliance with approved privacy and data 
security practices that conform to relevant data protection and privacy laws and regulations 
covering the use of personal data in at least the individual's or the entity's country of 
location;(Column 2, lines 39-61) 

means for obtaining the individual's consent t have the entity receive, or acknowledgment 
that the entity will receive, and use 1 his/her personal data in accordance with a stated policy or 
with relevant data protection and privacy laws arid regulations covering the use of personal data 
in at least the individual's or the entity's country of location;(Column 3, lines 15-28) 

means for transmitting to the entity data indicating, that the individual has been informed 
of the entity's privacy practices and consent to the entity, receiving, or acknowledgment that the 
entity will be receiving, and using his/her personal data in accordance with its stated policy or 
with relevant data protection and privacy laws and 

regulations covering the use of personal data in at least the individual's or the entity's country of 
location;(Column 2, lines 39-61) 

means for receiving from the entity data comprising personal data collected by the entity 
from the individual and means for storing said personal data received from the entity ;(Figure 1) 

Official Notice is taken that "periodically checking whether the entity has complied with 
the stated policy or with relevant data protection and privacy laws and regulation covering the 
use of personal data in at least the individual's or the entity's country of location." is common and 
well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to periodically check whether the entity has complied with the stated policy or with 
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relevant data protection and privacy laws and regulation covering the use of personal data in at 
least the individual's or the entity's country of location in order to in order to allow the entity to 
correct any inadvertent violations of privacy laws that might have occurred 

As per claim 22, 

Coueignoux ('197) discloses a system according to claim 21. 

Official Notice is taken that " informing the individual that the entity is covered by 
insurance or equivalent risk: instrument to protect against risk of loss of harm caused to the 
individual arising from misuse or loss of the individual's personal data by the entity." is common 
and well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to inform the individual that the entity is covered by insurance or equivalent risk: 
instrument to protect against risk of loss of harm caused to the individual arising from misuse or 
loss of the individual's personal data by the entity in order to in order to promote consumer 
confidence in the system. 

As per claim 23, 

Coueignoux ( 6 197) discloses a system according to claim 21 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgment that the entity will receive, and use the individual's personal data comprises 
data uniquely identifying details relating to the individual's consent.(Column 5, lines 44-64) 

As per claim 24, 

Coueignoux ('197) discloses a system according to claim 23 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgement that the entity will receive, and use the individual's personal data and 
uniquely identifying details relating to the individual's consent is compressed using a hash 
function.(Column 13, lines 43-51) 

As per claim 25, 

Coueignoux ('197) discloses a system according to claim 24 

wherein said data received from the entity comprising personal data collected by the 

entity from :lie individual, includes the data transmitted to the entity uniquely identifying details 

relating to the individual's consent.(Column 6, lines 59-62) 

As per claim 26, 

Coueignoux ( c 197) discloses a system according to claim 21 

Official Notice is taken that " the individual is informed in an official language of the 
individual's country of location" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to inform the individual in an official 
language of the individual's country of location in order to allow the individual to comprehend 
the message, and provide a useful service. 
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As per claim 27, 
_ Coueignoux ('197) discloses a system according to claim 2 1 

conducted as a multi-entity privacy policy certification program requiring member 
entities to certify compliance with approved privacy standards for the use of personal data of 
individuals and providing such entities with a policy notice to confirm their approval by, and 
membership in, the program.(Column 2, lines 39-61) 

As per claim 34, 

Coueignoux ('197) discloses a system according to claim 21 
- Wherein the data received from the entity comprising the individual's stored personal 
data includes the time period of the individual's consent or acknowledgment, the length of time 
that the individual's personal data will be retained, and an option to extend or renew the 
individual's consent or acknowledgment, if desired, notice thereof being provided to the entity an 
a the individual in advance of expiration of the consent.(Column 5, lines 44-64) 

As per claim 35, 

Coueignoux ('197) discloses a system according to claim 34 

wherein the individual is provided with the option of having the individual's personal data 
deleted from the entity's data storage upon expiration of the agreement.(Column 16, lines 43-56) 

As per claim 37, 

Coueignoux ( c 197) discloses a system according to claim 21, 

wherein the steps of informing the individual, obtaining the individual's consent or 

acknowledgment, transmitting, data to the entity, and receiving data from the entity are 

performed over a computer network.(Figure 1) 

As per claim 38, 

Coueignoux ('197) discloses a system according to claim 37, 
wherein the computer network is the Internet.(Figure 1) 

Claims 6,10 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Coueignoux (US Patent 6,092,197) in view of Clayton et al. (US Patent application 
09/754898) 

As per claim 6, 

Coueignoux (' 197) discloses a method according to claim 1 

Coueignoux (' 197) does not explicitly disclose "performed with a multiplicity of entities 
and individuals located in a single country", Clayton et al. discloses "performed with a 
multiplicity of entities and individuals located in a single country". ( Page 2, lines 26-28) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Coueignoux ('197) method with the Clayton et al. method in order to 
maximize efficiency by processing multiple entities at a single time. 



As per claim 10, 
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■ Coueignoux (' 1 97) discloses a method according to claim 9 
Coueignoux ('197) does not explicitly disclose "the approved standards meet the 
standards required by the United States, European Union, or other countries or regional 
organizations.", Clayton et al. discloses "the approved standards meet the standards required by 
the United States, European Union, or other countries or regional organizations."^ Page 1, lines 
28-3 1) It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to combine the Coueignoux ( c 1 97) method with the Clayton et al. method in 
order in order to allow the individual to provide a useful service. 

As per claim 28, 

Coueignoux ('197) discloses a system according to claim 27 
Coueignoux ('197) does not explicitly disclose "the approved standards meet the 
standards required by the United States, European Union, or other countries or regional 
organizations.", Clayton et al. discloses "the approved standards meet the standards required by 
the United States, European Union, or other countries or regional organizations."^ Page 1, lines 
28-3 1) It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to combine the Coueignoux (' 197) method with the Clayton et al. method in 
order in order to allow the individual to provide a useful service. 



Allowable Subject Matter 

Claims 1 1-15,18,29-33 and 36 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims and complying with double patenting statutes. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 

Conclusion 

Examiners note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to the specific 
limitations within the individual claim, other passages and figures may apply as well. It is 
respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M Winter whose telephone number is (703) 305-3971 . The 
examiner can normally be reached on M-F 8:30-6, 1st Fridays off. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James P Trammell can be reached on (703)305-9768. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-7687 for regular 
communications and (703) 305-7687 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 308-1 1 13. 



JMW 

February 23, 2004 




